fix: filter split-fs-invisible mounts when sysroot-stage is active (arc-dind)

src/compose-generator.test.ts

@@ -495,5 +495,31 @@ describe('generateDockerCompose', () => {
 
         expect(result.volumes).toEqual({ sysroot: {} });
       });
+
+      it('filters out workDir-based and home-based bind mounts on split-fs', () => {
+        const config = {
+          ...mockConfig,
+          runnerTopology: 'arc-dind' as const,
+          workDir: '/tmp/awf-12345',
+        };
+        const result = generateDockerCompose(config, mockNetworkConfig);
+        const volumes = result.services.agent.volumes as string[];
+
+        // workDir-based mounts should be dropped
+        expect(volumes.some(v => v.startsWith('/tmp/awf-12345'))).toBe(false);
+
+        // Home-based mounts targeting /host/home should be dropped
+        const homeTargets = volumes.filter(v => {
+          const target = v.split(':')[1];
+          return target.startsWith('/host/home') && !v.startsWith('/dev/null');
+        });
+        expect(homeTargets).toHaveLength(0);
+
+        // Should still have /tmp:/tmp, /sys, /dev, sysroot volume
+        expect(volumes).toContain('/tmp:/tmp:rw');
+        expect(volumes).toContain('/sys:/host/sys:ro');
+        expect(volumes).toContain('/dev:/host/dev:ro');
+        expect(volumes).toContain('sysroot:/host:rw');
+      });
     });
 });

src/compose-generator.ts

@@ -126,9 +126,33 @@ export function generateDockerCompose(
       '/host/lib64',
       '/host/opt',
     ]);
+
+    // On split-fs ARC/DinD, the Docker daemon cannot see the runner's
+    // filesystem paths. Filter out bind mounts the daemon can't resolve:
+    //  - Source under workDir (runner's unshared /tmp/awf-*): daemon can't see it
+    //  - Source under effectiveHome with target under /host: sysroot volume provides these
+    //  - Sysroot-shadowed targets: system binaries already in the sysroot volume
+    // Keep: /tmp:/tmp (daemon has its own), /dev/null overlays, /dev and /sys
+    //       (kernel VFS), workspace mounts (ARC shares workspace with daemon).
+    const workDirPrefix = config.workDir;
+    const hostHomeMountPrefix = `/host${effectiveHome}`;
+
     const filteredVolumes = agentVolumes.filter(volume => {
-      const target = volume.split(':')[1];
-      return !sysrootShadowedTargets.has(target);
+      const parts = volume.split(':');
+      if (parts.length < 2) return true; // Keep malformed entries unchanged
+      const source = parts[0];
+      const target = parts[1];
+
+      // Drop sysroot-shadowed targets (system binaries provided by volume)
+      if (sysrootShadowedTargets.has(target)) return false;
+
+      // Drop mounts sourced from AWF workDir (runner's unshared /tmp/awf-*)
+      if (source.startsWith(workDirPrefix)) return false;
+
+      // Drop home directory mounts targeting /host/home/... — sysroot provides them
+      if (source.startsWith(effectiveHome) && target.startsWith(hostHomeMountPrefix)) return false;
+
+      return true;
     });
     agentVolumes.length = 0;
     agentVolumes.push(...filteredVolumes);

src/services/agent-volumes/volume-builder.ts

@@ -42,7 +42,13 @@ export function buildAgentVolumes(params: AgentVolumesParams): string[] {
   agentVolumes.push(...buildSystemMounts(workspaceDir, config.chrootBinariesSourcePath, useSysroot));
   agentVolumes.push(...buildHomeMounts({ config, effectiveHome, agentLogsPath, sessionStatePath }));
   agentVolumes.push(...buildEtcMounts(config));
-  agentVolumes.push(generateHostsFileMount(config));
+  // When sysroot-stage is active, the sysroot volume provides /etc/hosts.
+  // The generated chroot hosts file lives on the runner's /tmp which the
+  // Docker daemon cannot see on split-fs. DNS pre-resolution is skipped;
+  // the agent resolves domains at runtime via the container's DNS config.
+  if (!useSysroot) {
+    agentVolumes.push(generateHostsFileMount(config));
+  }
   agentVolumes.push(...buildDockerSocketMount(config));
   agentVolumes.push(...buildSslMounts(sslConfig));
   agentVolumes.push(...buildCustomVolumeMounts(config.volumeMounts));